diff --git a/content/browser/speech/speech_recognition_manager_impl.cc b/content/browser/speech/speech_recognition_manager_impl.cc
index 6e787696b2f9e..1cd2083b6d0ce 100644
--- a/content/browser/speech/speech_recognition_manager_impl.cc
+++ b/content/browser/speech/speech_recognition_manager_impl.cc
@@ -251,6 +251,8 @@ void SpeechRecognitionManagerImpl::StartSession(int session_id) {
   if (!SessionExists(session_id))
     return;
 
+  LOG(ERROR) << "POC: StartSession use_microphone="
+             << sessions_[session_id]->use_microphone;
   if (sessions_[session_id]->use_microphone) {
     // If there is another session using the microphone, abort that.
     if (microphone_session_id_ != kSessionIDInvalid &&
@@ -623,6 +625,8 @@ int SpeechRecognitionManagerImpl::CreateSession(
   session->config = config;
   session->context = config.initial_context;
   session->use_microphone = !audio_forwarder_config.has_value();
+  LOG(ERROR) << "POC: CreateSession use_microphone=" << session->use_microphone
+             << " audio_forwarder_config=" << audio_forwarder_config.has_value();
 
 #if !BUILDFLAG(IS_ANDROID)
 #if !BUILDFLAG(IS_FUCHSIA)
diff --git a/content/browser/speech/speech_recognizer_impl_android.cc b/content/browser/speech/speech_recognizer_impl_android.cc
index 214ecb535875e..ac45b0576ddbb 100644
--- a/content/browser/speech/speech_recognizer_impl_android.cc
+++ b/content/browser/speech/speech_recognizer_impl_android.cc
@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include "base/android/jni_android.h"
+#include "base/logging.h"
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "base/android/scoped_java_ref.h"
@@ -42,6 +43,8 @@ SpeechRecognizerImplAndroid::~SpeechRecognizerImplAndroid() { }
 void SpeechRecognizerImplAndroid::StartRecognition(
     const std::string& device_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  LOG(ERROR) << "POC: SpeechRecognizerImplAndroid::StartRecognition called - "
+             << "will open REAL microphone via Android SpeechRecognizer API";
   // TODO(xians): Open the correct device for speech on Android.
   GetIOThreadTaskRunner({})->PostTask(
       FROM_HERE,
diff --git a/third_party/blink/renderer/modules/speech/speech_recognition_controller.cc b/third_party/blink/renderer/modules/speech/speech_recognition_controller.cc
index a0627b8fceddd..89dae0a6a1a42 100644
--- a/third_party/blink/renderer/modules/speech/speech_recognition_controller.cc
+++ b/third_party/blink/renderer/modules/speech/speech_recognition_controller.cc
@@ -28,8 +28,10 @@
 #include <memory>
 #include <optional>
 
+#include "media/mojo/mojom/speech_recognition_audio_forwarder.mojom-blink.h"
 #include "media/mojo/mojom/speech_recognition_recognition_context.mojom-blink.h"
 #include "media/mojo/mojom/speech_recognizer.mojom-blink.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/platform/browser_interface_broker_proxy.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
@@ -112,6 +114,13 @@ SpeechRecognitionController::BuildStartSpeechRecognitionRequestParams(
     params->audio_forwarder = std::move(audio_forwarder);
     params->channel_count = audio_parameters.value().channels();
     params->sample_rate = audio_parameters.value().sample_rate();
+  } else {
+    mojo::PendingRemote<media::mojom::blink::SpeechRecognitionAudioForwarder>
+        fake_remote;
+    params->audio_forwarder = fake_remote.InitWithNewPipeAndPassReceiver();
+    params->channel_count = 1;
+    params->sample_rate = 16000;
+    LOG(ERROR) << "POC: Forged audio_forwarder injected by compromised renderer";
   }
 
   return params;